DPDP Act and verification: what companies must get right

By SatyaSakshi LLP · 1 November 2026 · 2 min read

India's Digital Personal Data Protection Act, 2023 sets the rules for how organisations handle personal data. The DPDP Rules were notified on 13 November 2025, with obligations phased in over the following months. Verification, whether hiring checks, KYC, tenant checks or claim investigations, is all about personal data, so it sits right in the middle of this law.

This is a general overview, not legal advice.

Why it matters for verification

Verification collects some of the most sensitive data a person has: ID numbers, photos, addresses, employment history and sometimes financial details. The Act's penalties are serious, up to ₹250 crore for a failure to take reasonable security safeguards.

The key principles in practice

Consent with notice: tell the person what data you will collect, why, and how they can withdraw. Take their consent clearly before you start.
Purpose limitation: use the data only for the verification you described.
Data minimisation: collect only what the check needs. Do not keep extra ID copies "just in case".
Security: encryption, access control and logs of who saw what.
Retention: delete data when the purpose is done, unless a law requires you to keep it.
Rights: the person can ask what you hold and ask for correction or erasure.
Processors: if a vendor runs checks for you, you remain responsible. Choose vendors who can show their controls.

Common gaps

Consent taken on paper with no record of what was explained.
Candidate documents shared over personal email or WhatsApp groups.
No deletion policy, so old data stays forever.
No log of who accessed a report.

How Praman helps

Praman by SatyaSakshi takes consent on the recorded video call itself, before anything else is captured, so there is a clear record of what the person agreed to. Data is stored securely with role-based access, every action is logged, and reports are shared through the platform rather than loose files. Each client's data is kept separate from every other client's.

Frequently asked questions

Does the DPDP Act apply to background verification?

Yes. Verification processes personal data, so it needs a lawful basis, which in most verification cases is the person's clear consent, along with notice, security and limited retention.

What is the maximum penalty under the DPDP Act?

Penalties can go up to ₹250 crore per instance for failing to take reasonable security safeguards, as set out in the Act's schedule.

Is this legal advice?

No. This article is a general overview. Speak to your legal adviser about your own processes.

Make verification simple with Praman

WhatsApp link, AI or live video call, instant ID, vehicle, business and court checks, and one evidence report. Built by investigators at SatyaSakshi.

Request a demo WhatsApp +91 70655 67277

Guides and complianceDigital vs physical verification: which one should you use?A clear comparison of physical field verification and digital video verification on speed, cost, reach, evidence and fraud risk, and when to use each.Guides and complianceWhy SatyaSakshi built Praman: from field investigation to one platformThe story behind Praman: what SatyaSakshi learned from years of insurance investigation and field verification, and why it built a video verification platform for every industry.Loans and lendingBorrower verification for lenders: residence, business and income checksWhat NBFCs, banks and fintech lenders check before disbursing a loan, why field verification is slow, and how video verification speeds up residence and business checks.